SecureChain for Open Source Software

Key Takeaways Cargo source replacement assumes the replacement serves the same crate contents, which is why it needs no project file changes. Registry-side screening judges a crate on what it...

Key Takeaways Packagist indexes Git tags instead of hosting artifacts, so until July 2026 a published version could be quietly repointed at a different commit. Two 2026 incidents ran that...

Key Takeaways An abandoned package stays installable through Packagist, open CVEs and all, because fixing packages was never Packagist’s job. SecureChain rebuilds and screens PHP packages before install, then keeps...

Key Takeaways Public PyPI checks who published a package, not what the package does. SecureChain screens and rebuilds packages before they reach your environment. Rebuilt artifacts carry new hashes, so...

A CVE ID shows up in your terminal, attached to a package you never installed on purpose, and the reflex is to assume the worst. We’ve all been there. These...

Key Takeaways Socket blocks malicious packages at any dependency depth and now backports patches across nine ecosystems. Sonatype Firewall screens at ingress but steers you toward an upgrade instead of...

Key Takeaways A package published one namespace segment away from Jackson served Cobalt Strike from Maven Central in December 2025, no CVE involved. Maven Central verifies control of a namespace’s...

Key Takeaways A malicious build.rs script runs during cargo build with the privileges of whatever process invoked Cargo. Stable Cargo gives you no supported way to compile a dependency tree...

Key Takeaways For fixed versions, Maven queries repositories in order and takes your coordinates from the first that has them. A dependency’s own POM can add repositories to your build,...

Key Takeaways npm audit can only compare your tree against advisory data, so a malicious version published an hour ago won’t be flagged. Closing that gap takes more than one...

Key Takeaways cargo audit only knows about advisories someone already filed. Build scripts and proc macros run arbitrary code at compile time, and stable Cargo can’t switch that off. An...